topic Re: How to display individual URI counts by user with timechart or stats? in Splunk Search

How to display individual URI counts by user with timechart or stats?

Aaron_Fogarty — Fri, 24 Jun 2016 16:07:08 GMT

I am looking to display individual URI count by User on a timechart. Is this possible?

My current search returns the monthly total Accesses by User. I would like to see the monthly Access count of each URI by User

index=* sourcetype=* User="*" Download "https://abc.com/content/mobile" | eval URI=case(match(_raw,"DailyNotes"), "DailyNotes",match(_raw,"Stock"),"Stock",match(_raw,"Sector"),"Sector",match(_raw,"Search"),"Search" ) | eval User=lower(User) | lookup  lookup1.csv user_id as User| timechart span=1mon count by Name limit=0

If this is not possible on a timechart, can it be done in a statistics chart?

Re: How to display individual URI counts by user with timechart or stats?

somesoni2 — Fri, 24 Jun 2016 16:16:45 GMT

Depends upon how many unique combinations you've for Name and URI, try this

For smaller number- timechart

 index=* sourcetype=* User="*" Download "https://abc.com/content/mobile" | eval URI=case(match(_raw,"DailyNotes"), "DailyNotes",match(_raw,"Stock"),"Stock",match(_raw,"Sector"),"Sector",match(_raw,"Search"),"Search" ) | eval User=lower(User) | lookup  lookup1.csv user_id as User | eval Name=Name.":".URI | timechart span=1mon count by Name limit=0

Stats

index=* sourcetype=* User="*" Download "https://abc.com/content/mobile" | eval URI=case(match(_raw,"DailyNotes"), "DailyNotes",match(_raw,"Stock"),"Stock",match(_raw,"Sector"),"Sector",match(_raw,"Search"),"Search" ) | eval User=lower(User) | lookup  lookup1.csv user_id as User | eval Name=Name.":".URI | bucket span=1mon _time | stats count by _time Name URI

Re: How to display individual URI counts by user with timechart or stats?

sundareshr — Fri, 24 Jun 2016 16:18:08 GMT

Try this

 index=* sourcetype=* User="*" Download "https://abc.com/content/mobile" | eval URI=case(match(_raw,"DailyNotes"), "DailyNotes",match(_raw,"Stock"),"Stock",match(_raw,"Sector"),"Sector",match(_raw,"Search"),"Search" ) | eval User=lower(User) | lookup  lookup1.csv user_id as User| bin span=1mon _time as time | eval t=time."#".uri | chart count over t by Name | rex field=t (?<Time>[^#]+)#(?<URI>.*)" | eval Time=strftime(Time, "%x %X")

Re: How to display individual URI counts by user with timechart or stats?

woodcock — Fri, 24 Jun 2016 16:28:10 GMT

Like this:

index=* sourcetype=* User="*" Download "https://abc.com/content/mobile" | eval URI=case(match(_raw,"DailyNotes"), "DailyNotes",match(_raw,"Stock"),"Stock",match(_raw,"Sector"),"Sector",match(_raw,"Search"),"Search" ) | eval User=lower(User) | lookup  lookup1.csv user_id as User| eval URI_and_User = URI . "::" . User | timechart span=1mon count BY URI_and_User limit=0

Because timechart can only breakout a single BY field, we are combining 2 fields into 1 and breaking out BY that one.

Re: How to display individual URI counts by user with timechart or stats?

Aaron_Fogarty — Mon, 27 Jun 2016 12:01:01 GMT

Thanks for your help guys, much appreciated.